---
title: "Revoke an end-user token"
method: DELETE
path: "/credits/end-users/{externalUserId}/tokens/{tokenId}"
tags: ["End users"]
---

# Revoke an end-user token

`DELETE /credits/end-users/{externalUserId}/tokens/{tokenId}`

## Request

- Base URL: `https://api.paywithlocus.com/api`
- URL: `https://api.paywithlocus.com/api/credits/end-users/{externalUserId}/tokens/{tokenId}`
- Auth: one of:
  - HTTP bearer
  - HTTP bearer

Revokes one outstanding end-user token by its durable jti. Revocation takes effect immediately on the next use, which is the only way to cut a leaked token short — bearer tokens are otherwise replayable until they expire.

## Path parameters

- `externalUserId` string, required: Case-sensitive immutable ID in the tenant namespace. Prefer an identity-provider subject, not an email address.
- `tokenId` string, required

## Request body

- object
  - `reason` string: Recorded on the credential audit event.

## Response `204`

Revoked.

## Other responses

- `403`: The authenticated management credential lacks one or more required scopes
- `404`: No such token for this end user.

---

[API](https://skmtc.dev/paywithlocus/apis/locus-pro-api.md) - [All operations](https://skmtc.dev/paywithlocus/apis/locus-pro-api/llms.txt) - [OpenAPI document](https://skmtc.dev/paywithlocus/apis/locus-pro-api/revisions/aab8fa5d6cef?raw)